Summary
The /transcript command can be used by anyone to get the transcript of other members' tickets.
Details
In the affected versions, the /transcript has no permission/authorisation checks, so if you have the channel ID of a ticket, it will respond with the generated transcript no matter who you are. This is only possible if the archiving feature is enabled in your guild.
It is worse for public bots as (if giving the channel ID manually) the /transcript command works across guilds, meaning that revoking access to the /transcript command does not remove the vulnerability if users can add the bot to their own guilds.
This shouldn't be an issue, but despite being hidden in the Discord client, users can access the name and ID of channels they don't have permission to view. This hidden information can be made visible using client modifications such as Better Discord.
PoC
- Create a ticket.
- With developer mode enabled, copy the channel ID. This is where client modifications would be used by unauthorised members to show hidden channels.
- Close the ticket.
- Switch to another account that has no permissions.
- Type
/transcript ticket: and paste the channel ID.
Original report by @MsEDok
Summary
This let anyone that can use /transcript to get the target transcript
Details
When a user do '/transcript' it suggest a list of the ticket that the user have created but if the user know the channel id it possible to get the transcript
PoC
with public bot
- invite the public bot to your private server
- join a server that use the public bot
- use "better discord" or tool to see hidden channel (the user that told me this use some browser extension)
- copy the channel ID and back to the private server and do /transcript you will get the transcript of that channel
with selfhost bot
- get the channel ID on the selfhost bot discord
- find an allowed channel that allowed "/transcript"
- do /transcript
- get the transcript
Impact
security vulnerability, impact anyone who use the bot (public, selfhost) have not tested with managed bot but assume it the same
MsEDok Reporter
eartharoid Remediation developer
Summary
The
/transcriptcommand can be used by anyone to get the transcript of other members' tickets.Details
In the affected versions, the
/transcripthas no permission/authorisation checks, so if you have the channel ID of a ticket, it will respond with the generated transcript no matter who you are. This is only possible if the archiving feature is enabled in your guild.It is worse for public bots as (if giving the channel ID manually) the
/transcriptcommand works across guilds, meaning that revoking access to the/transcriptcommand does not remove the vulnerability if users can add the bot to their own guilds.This shouldn't be an issue, but despite being hidden in the Discord client, users can access the name and ID of channels they don't have permission to view. This hidden information can be made visible using client modifications such as Better Discord.
PoC
/transcript ticket:and paste the channel ID.Original report by @MsEDok